TXT record (text record)

What is a TXT record?

A TXT (Text) record is a DNS record type that stores arbitrary text strings associated with a domain. Originally intended for human-readable notes, TXT records have become essential for machine-readable data like email authentication policies, domain ownership verification, and service-specific configurations.

Common TXT record uses

Email authentication

example.com.    IN    TXT    "v=spf1 include:_spf.google.com ~all"

Specifies which servers can send email for your domain.

google._domainkey.example.com.    IN    TXT    "v=DKIM1; k=rsa; p=MIGfMA0..."

Contains the public key for email signature verification.

_dmarc.example.com.    IN    TXT    "v=DMARC1; p=reject; rua=mailto:[email protected]"

Defines email authentication policy and reporting.

Domain verification

example.com.    IN    TXT    "google-site-verification=abc123..."

example.com.    IN    TXT    "MS=ms12345678"

_dnsauth.example.com.    IN    TXT    "validation-token-from-ca"

Other applications

example.com.    IN    TXT    "facebook-domain-verification=xyz789"

_keybase.example.com.    IN    TXT    "keybase-site-verification=..."

_app.example.com.    IN    TXT    "config=value123"

TXT record format

Basic syntax

name    IN    TXT    "text content here"

Multiple TXT records

A domain can have multiple TXT records:

example.com.    IN    TXT    "v=spf1 include:_spf.google.com ~all"
example.com.    IN    TXT    "google-site-verification=abc123"
example.com.    IN    TXT    "facebook-domain-verification=xyz789"

Long TXT records

TXT record strings are limited to 255 characters per string, but multiple strings can be concatenated:

selector._domainkey.example.com.    IN    TXT    (
    "v=DKIM1; k=rsa; "
    "p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA..."
    "...long key continues..."
)

DNS clients automatically concatenate these strings.

Checking TXT records

dig example.com TXT

; ANSWER SECTION:
example.com.    300    IN    TXT    "v=spf1 include:_spf.google.com ~all"

dig _dmarc.example.com TXT
dig selector._domainkey.example.com TXT

curl "https://domscan.net/v1/health?domain=example.com"
# Returns hasTXT and email authentication status

TXT record best practices

For email authentication

1. Always configure SPF, DKIM, and DMARC together

2. Use a single SPF record - multiple SPF records cause issues

3. Keep SPF lookups under 10 - exceeding causes failures

4. Test before deploying - use online validators

For domain verification

1. Don't remove verification TXT records - services may re-verify

2. Document what each TXT record is for - they can accumulate

3. Clean up unused records - remove records for services you no longer use

For custom applications

1. Use underscore prefixes (_app.example.com) to avoid conflicts

2. Document the format - future you will forget

3. Consider TTL - lower TTLs for frequently changed configs

Security considerations

Information disclosure

TXT records are public. Don't store sensitive information:

# Bad - exposes internal info
example.com.    TXT    "internal-api-key=secret123"

SPF vulnerabilities

Overly permissive SPF records can enable email spoofing:

# Bad - allows anyone to send
example.com.    TXT    "v=spf1 +all"

# Good - restrictive
example.com.    TXT    "v=spf1 include:_spf.google.com -all"

Troubleshooting TXT records

TXT records are the Swiss Army knife of DNS: versatile but requiring careful management as their usage grows.